Resolve Permission resolution in authorization_code/CIBA flows is not scoped to the requested resource server

backend/cmd/server/servicemanager.go

@@ -316,6 +316,12 @@ func registerServices(mux *http.ServeMux, cacheManager cache.CacheManagerInterfa
 	// CORS origins come from the server-config cors section.
 	cors.InitializeDynamicMatcher(serverConfigService)
 
+	// Decorate the resource provider so an empty identifier resolves the configured default resource
+	// server. Keeps the default-resource-server policy server-side: OAuth, CIBA, PAR, grant handlers,
+	// and the flow executor depend only on providers.ResourceServerProvider, not on serverConfigService.
+	// The base resourceService is still used for resource-management APIs and server-config validation.
+	resourceServerProvider := resource.NewDefaultAwareResourceServerProvider(resourceService, serverConfigService)
+
 	flowConfig := flowconfig.FromServerRuntime()
 	sessionService, sessionCfg := initSessionService(ctx, serverConfigService, runtime.Config.Server.Identifier, logger)
 	flowConfig.Session = sessionCfg
@@ -345,6 +351,7 @@ func registerServices(mux *http.ServeMux, cacheManager cache.CacheManagerInterfa
 			GoogleSvc:             googleAuthnService,
 			OpenID4VPVerifierSvc:  openid4vpSvc,
 			SessionService:        sessionService,
+			ResourceService:       resourceServerProvider,
 		},
 		interceptor.InterceptorDependencies{},
 		flowConfig,
@@ -450,7 +457,7 @@ func registerServices(mux *http.ServeMux, cacheManager cache.CacheManagerInterfa
 	// Initialize OAuth services.
 	err = oauth.Initialize(mux, actorProvider, authnProvider, jwtService, jweService,
 		flowExecService, observabilitySvc, runtimeCryptoSvc, ouService, attributeCacheService, authZService,
-		resourceService, serverConfigService, i18nService, idpService, dpopVerifier,
+		resourceServerProvider, i18nService, idpService, dpopVerifier,
 		runtimeStoreProvider, transactioner, oauthCfg)
 	fatalOnError(ctx, logger, err, "Failed to initialize OAuth services")
 

backend/internal/flow/common/constants.go

@@ -138,6 +138,11 @@ const (
 	RuntimeKeyClientID = "clientId"
 	// RuntimeKeyRequestedPermissions holds the space-separated permission scopes requested by the OAuth client.
 	RuntimeKeyRequestedPermissions = "requested_permissions"
+	// RuntimeKeyResourceServerIdentifier holds the identifier of the single resource server the request is
+	// bound to. When set, the authorization executor resolves it and scopes its permission evaluation to
+	// that resource server. Using the identifier (not the internal ID) keeps the executor contract the
+	// same for OAuth requests and direct flow executions.
+	RuntimeKeyResourceServerIdentifier = "resource_server_identifier"
 	// RuntimeKeyConsentedPermissions holds the space-separated permission scopes the user has consented to
 	// release to the client, as produced by the ConsentExecutor.
 	RuntimeKeyConsentedPermissions = "consented_permissions"

backend/internal/flow/executor/authz_executor.go

@@ -23,6 +23,7 @@ import (
 	"errors"
 
 	"github.com/thunder-id/thunderid/internal/entityprovider"
+	"github.com/thunder-id/thunderid/internal/flow/common"
 	"github.com/thunder-id/thunderid/internal/flow/core"
 	"github.com/thunder-id/thunderid/internal/system/log"
 	"github.com/thunder-id/thunderid/internal/system/utils"
@@ -39,10 +40,11 @@ const (
 // during flow execution. It enriches the flow context with authorized permissions.
 type authorizationExecutor struct {
 	providers.Executor
-	authzService   providers.AuthorizationProvider
-	entityProvider entityprovider.EntityProviderInterface
-	authnProvider  providers.AuthnProviderManager
-	logger         *log.Logger
+	authzService    providers.AuthorizationProvider
+	entityProvider  entityprovider.EntityProviderInterface
+	authnProvider   providers.AuthnProviderManager
+	resourceService providers.ResourceServerProvider
+	logger          *log.Logger
 }
 
 var _ providers.Executor = (*authorizationExecutor)(nil)
@@ -53,6 +55,7 @@ func newAuthorizationExecutor(
 	authZService providers.AuthorizationProvider,
 	entityProvider entityprovider.EntityProviderInterface,
 	authnProvider providers.AuthnProviderManager,
+	resourceService providers.ResourceServerProvider,
 ) *authorizationExecutor {
 	logger := log.GetLogger().With(log.String(log.LoggerKeyComponentName, authzLoggerComponentName),
 		log.String(log.LoggerKeyExecutorName, ExecutorNameAuthorization))
@@ -61,11 +64,12 @@ func newAuthorizationExecutor(
 		[]providers.Input{}, []providers.Input{}, &providers.ExecutorMeta{})
 
 	return &authorizationExecutor{
-		Executor:       base,
-		authzService:   authZService,
-		entityProvider: entityProvider,
-		authnProvider:  authnProvider,
-		logger:         logger,
+		Executor:        base,
+		authzService:    authZService,
+		entityProvider:  entityProvider,
+		authnProvider:   authnProvider,
+		resourceService: resourceService,
+		logger:          logger,
 	}
 }
 
@@ -110,6 +114,22 @@ func (a *authorizationExecutor) Execute(ctx *providers.NodeContext) (*providers.
 		return execResp, nil
 	}
 
+	// Resolve the single resource server the permission scopes are evaluated against: the OAuth layer
+	// seeds it in runtime data; a direct /flow/execute request (which does not go through the
+	// authorization endpoint) may supply it as an input; otherwise fall back to the configured default
+	// resource server. Permission evaluation must be scoped to a resource server, so when none can be
+	// resolved the requested permission scopes are dropped rather than evaluated unscoped (which could
+	// authorize a permission the user only holds on a different resource server).
+	resourceServerID := a.resolveResourceServerID(ctx)
+	if resourceServerID == "" {
+		logger.Debug(ctx.Context,
+			"No resource server bound to the request; dropping requested permission scopes",
+			log.Int("permissionCount", len(requestedPerms)))
+		setAuthorizedPermissions(execResp, []string{})
+		execResp.Status = providers.ExecComplete
+		return execResp, nil
+	}
+
 	logger.Debug(ctx.Context, "Determined required permissions", log.Int("count", len(requestedPerms)))
 
 	// Extract user ID and group IDs
@@ -125,7 +145,7 @@ func (a *authorizationExecutor) Execute(ctx *providers.NodeContext) (*providers.
 		log.Int("permissionCount", len(requestedPerms)))
 
 	authzResp, svcErr := a.authzService.EvaluateAccessBatch(ctx.Context,
-		a.buildAccessEvaluationsRequest(userID, groupIDs, requestedPerms))
+		a.buildAccessEvaluationsRequest(userID, groupIDs, requestedPerms, resourceServerID))
 	if svcErr != nil {
 		logger.Error(ctx.Context, "Authorization service call failed",
 			log.String("error", svcErr.Error.DefaultValue))
@@ -143,6 +163,33 @@ func (a *authorizationExecutor) Execute(ctx *providers.NodeContext) (*providers.
 	return execResp, nil
 }
 
+// resolveResourceServerID determines the internal ID of the single resource server that permission
+// scopes are evaluated against. The binding is communicated as a resource server identifier: the OAuth
+// layer seeds it in runtime data, and a direct /flow/execute request (which does not go through the
+// authorization endpoint) may supply it as an input. The identifier is resolved to its internal ID
+// through the provider; an empty identifier asks a default-aware provider to resolve the deployment's
+// configured default resource server. Returns "" when none can be resolved (unknown identifier, no
+// default configured, or no resource provider available, for example the embedded engine).
+func (a *authorizationExecutor) resolveResourceServerID(ctx *providers.NodeContext) string {
+	identifier := ctx.RuntimeData[common.RuntimeKeyResourceServerIdentifier]
+	if identifier == "" {
+		identifier = ctx.UserInputs[common.RuntimeKeyResourceServerIdentifier]
+	}
+	if a.resourceService == nil {
+		a.logger.Debug(ctx.Context,
+			"No resource server service available; dropping requested permission scopes")
+		return ""
+	}
+	rs, svcErr := a.resourceService.GetResourceServerByIdentifier(ctx.Context, identifier)
+	if svcErr != nil {
+		a.logger.Debug(ctx.Context,
+			"Resource server did not resolve; dropping requested permission scopes",
+			log.String("identifier", identifier))
+		return ""
+	}
+	return rs.ID
+}
+
 // extractRequestedPermissions extracts requested permissions from the context.
 func extractRequestedPermissions(ctx *providers.NodeContext) []string {
 	requestedPermissions := ctx.RuntimeData[requestedPermissionsKey]
@@ -163,6 +210,7 @@ func (a *authorizationExecutor) buildAccessEvaluationsRequest(
 	entityID string,
 	groupIDs []string,
 	requestedPermissions []string,
+	resourceServerID string,
 ) providers.AccessEvaluationsRequest {
 	evaluations := make([]providers.AccessEvaluationRequest, 0, len(requestedPermissions))
 	for _, permission := range requestedPermissions {
@@ -171,7 +219,8 @@ func (a *authorizationExecutor) buildAccessEvaluationsRequest(
 				ID:       entityID,
 				GroupIDs: groupIDs,
 			},
-			Permission: providers.Permission{Name: permission},
+			ResourceServer: providers.AccessEvaluationResourceServer{ID: resourceServerID},
+			Permission:     providers.Permission{Name: permission},
 		})
 	}
 	return providers.AccessEvaluationsRequest{Evaluations: evaluations}